Data harvesting on the digital farm - social games and privacy

By Nadine Hantke Sep 12, 2010, 14:25 GMT

Munich - Millions of people go online every day to harvest fruit and vegetables, buy seeds and tractors, shear their sheep and milk their cows.

It's just another standard day on the virtual farm games offered by social networking sites like Facebook. Other people opt to keep virtual aquariums, work as cooks or pretend to be mobsters.

But what many players don't know is that while they're busy having fun, others are busy collecting personal data about them. Experts have started to warn about the risks of giving up too much information unintentionally.

Social games are free and don't need to be installed on a computer, since they can be played via a browser. Since the games rely on communication and interaction between players, social networks are an ideal platform for them.

Thanks to those networks, the games have spread rapidly in very little time. Industry leader Zynga reports that it alone draws about 230 million players a month to play Mafia Wars, Poker or Farmville.

The gaming industry sees a lucrative market. A study by the German consulting company of Muecke, Sturm & Company found that companies in this industry earn between 680 million and 1.3 billion euros (872 million and 1.67 billion dollars) a year with social games.

But how do they earn that money? Microtransactions are the key. Although the games are free, anyone who wants to get a leg up, have a little extra play money or own especially useful goods can do so by paying out some real money.

'Less than 5 per cent of the players use this opportunity and the individual sales are small. But, with millions of players, that quickly adds up to a lot,' says Jens Begemann, director of Wooga, a social gaming company based in Berlin.

Data is the second kind of currency in the world of social gaming. As soon as players register with the games, the managers of the social network transfer the player's data to the gaming company.

The kind of information depends on the network and the supplier. Facebook regularly supplies all publicly available information.

Anyone who wants to play with Facebook might also have to accept that their e-mail address, date of birth, list of friends and hometown might be forwarded to the game company. This is allowed in some countries as soon as permission is given.

'If the user has had the terms explained and approved the use of his data, then they can be shared,' says Carsten Ulbricht, a German attorney specializing in internet law.

Profile data that the user has set as public, which means it can also be found in a Google search, can then be offered to the game companies. American companies like Facebook tend to have less transparent data protection guidelines, Ulbricht says.

Begemann sees no way around some data being saved for social games.

'You want to play with your friends. If names and pictures aren't transferred, then no one knows with whom they're playing,' he noted.

But the personal data can also be used for personalized advertising.

'We only use the data for our players. I can't say what happens with other companies. But all large providers have monetized their virtual goods,' Begemann says.

Anyone who wants to protect their information should read the data protection clauses and ask whether the requested data can be divulged, advises Henry Krasemann, of the independent data protection centre of the German state of Schleswig-Holstein. It's a good sign when a provider only asks for the minimum level of data.

'One should only provide as much as is necessary,' he says.

It's hard to do too much with individual pieces of data, but put together they can create a profile that could be useful for advertising interests.

Ulbricht says one alternative is to register under a pseudonym, even if that does conflict with the operating procedures of some websites.

'The worst that can happen is that the account gets erased,' he says. That would mean the loss of a virtual farm and all the work involved in creating it, but one's data would remain private.